PT-2026-87036

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...